# 生产覆盖层：
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml --profile full up -d --build
#
# 变化点：
# - postgres/redis 不再暴露到公网（去掉 ports）
# - frontend 监听 80 + 443，挂载 Let's Encrypt 证书 + ACME 挑战目录 + 生产 nginx.conf
# - backend 不再暴露到公网（由 nginx 反代）
# - 加上 certbot 容器，定期续签
services:
  postgres:
    ports: !reset []
    restart: always

  redis:
    ports: !reset []
    restart: always

  backend:
    ports: !reset []
    restart: always
    environment:
      APP_ENV: prod
      APP_BASE_URL: https://ai.aidfxn.com
      CORS_ALLOW_ORIGINS: https://ai.aidfxn.com

  frontend:
    restart: always
    ports: !override
      - "80:80"
      - "443:443"
    volumes:
      - ./docker/nginx.prod.conf:/etc/nginx/conf.d/default.conf:ro
      - ./certbot/conf:/etc/letsencrypt:ro
      - ./certbot/www:/var/www/certbot:ro

  certbot:
    image: certbot/certbot:latest
    container_name: loom-certbot
    restart: unless-stopped
    volumes:
      - ./certbot/conf:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
    # 12h 检查一次是否续签
    entrypoint: /bin/sh -c 'trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot --quiet; sleep 12h & wait $${!}; done'
    profiles: ["full"]
    depends_on:
      - frontend